Robust Anomaly Detection Under Normality Distribution Shift in Dynamic Graphs
This addresses a critical issue for applications like social networks and cybersecurity, but it is incremental as it builds on existing anomaly detection methods by specifically handling distribution shifts.
The paper tackles the problem of anomaly detection in dynamic graphs under normality distribution shift, where normal behaviors evolve over time, by proposing WhENDS, an unsupervised method that aligns normal edge embeddings across time, achieving state-of-the-art results on four datasets and outperforming nine baselines.
Anomaly detection in dynamic graphs is a critical task with broad real-world applications, including social networks, e-commerce, and cybersecurity. Most existing methods assume that normal patterns remain stable over time; however, this assumption often fails in practice due to the phenomenon we refer to as normality distribution shift (NDS), where normal behaviors evolve over time. Ignoring NDS can lead models to misclassify shifted normal instances as anomalies, degrading detection performance. To tackle this issue, we propose WhENDS, a novel unsupervised anomaly detection method that aligns normal edge embeddings across time by estimating distributional statistics and applying whitening transformations. Extensive experiments on four widely-used dynamic graph datasets show that WhENDS consistently outperforms nine strong baselines, achieving state-of-the-art results and underscoring the importance of addressing NDS in dynamic graph anomaly detection.